The Central KYC Records Registry (“CKYCR”) was conceived as a shared infrastructure to reduce duplication in customer due diligence (“CDD”), minimise customer friction, and allow regulated entities (“REs”) to rely on a common repository of KYC records. While this objective has always been clear, the regulatory framework governing CKYCR reliance has historically suffered from an important ambiguity: whether there is a requirement to re-verify the KYC documents made available from the CKYCR?

The Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025 (“KYC MD”) permits reliance on third-party KYC and CKYCR records and allows REs to download KYC records from CKYCR, while also recognising that additional information may be required in certain cases. In practice, however, the absence of an explicit allocation of responsibility led to divergent approaches. Some NBFCs continued to re-verify identity and address documents despite CKYCR downloads, while others assumed that reliance on CKYCR substantially displaced their KYC obligations.

The explanation now introduced (“Explanation”) seeks to resolve this uncertainty by clearly delineating responsibility. The explanation reads as follows:

“The RE that has last uploaded or updated the customer’s KYC records in the CKYCR shall be responsible for verifying the identity and/or address of the customer, as applicable. Accordingly, any NBFC downloading and relying on such records from the CKCYR shall not be required to re-verify the authenticity of the customer’s identity and / or address, provided the KYC records downloaded from CKYCR are current and compliant with the PML Act, 2002 / PML Rules, 2005. The NBFC downloading and relying on KYC records downloaded from the CKCYR shall remain responsible for all aspects of CDD procedure and provisions of these Directions, except verification of identity and / or address of the customer.”

This clarification introduces a clear bifurcation between the RE that last uploaded or updated the KYC record in CKYCR and the RE that subsequently downloads and relies upon it. Responsibility for verification of identity and/or address is expressly placed on the last updating RE. The downloading RE is relieved of the obligation to re-verify these elements, subject to the condition that the CKYCR records are “current and compliant”. The Explanation makes it clear that the downloading RE continues to remain responsible for all other aspects of the CDD framework under the KYC Master Directions. The intent of the explanation is obvious – while identity and address verification are treated as discrete functions capable of centralisation, fraud risk assessment, ongoing due diligence, transaction monitoring, and AML controls remain RE-specific.

A related question that still remains yet to be addressed is – whether the enhanced due diligence requirement of positive address verification (especially for non-face-to-face onboarding) will be done away with when entities rely on CKYCR data. Players in the market appear to be leaning towards the interpretation that the requirement for positive address verification would no longer be required in CKYCR flows since there is an express permission to rely on the address obtained from the CKYCR records.

The Explanation is a targeted clarification reallocating responsibility for identity and address verification and preserving the principle that AML risk assessment is contextual and non-delegable. REs must therefore recognise that CKYCR data cannot be treated as a conclusive source of truth, but as a reliable verification mechanism when records are complete, affirmed by the customer, and not contradicted by risk indicators. Read this way, the Explanation aligns operational efficiency with regulatory accountability, without compromising the integrity of the KYC regime.